{
  description = "NixOS system flake";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.11";
    nixos-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
    home-manager = {
      url = "github:nix-community/home-manager/release-23.11";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    lanzaboote = {
      url = "github:nix-community/lanzaboote/v0.3.0";
      # deliberately do _not_ follow the nixpkgs input here, because paranoia and test coverage
    };
    utils.url = "github:numtide/flake-utils";

      nur.url = "github:nix-community/NUR";
    # TODO: possible make this a flake as well
    mysecrets = {
      flake = false;
      url = "git+ssh://gitea@git.orlives.de:2342/schmittlauch/home-manager_secrets.git";
    };

  };

  outputs = 
  { self, nixpkgs, nur, lanzaboote, utils, home-manager, ... }@inputs: 
  let
    # FIXME: allow different systems
    systems = utils.lib.system;
    # necessary to make the top-level inputs available to system configuration
    # inspired by https://jade.fyi/blog/flakes-arent-real/
    inputInjection = {pkgs, lib, ...}: {
      options.inputInjection = lib.mkOption {
        type = with lib.types; attrsOf unspecified;
        default = {};
      };
      config.inputInjection = {
        flake-inputs = inputs;
      };
    };
    defaultModules = system: [
      inputInjection
    ];
    mkSystem = system: extraModules:
      nixpkgs.lib.nixosSystem rec {
        modules = (defaultModules system) ++ extraModules;
        inherit system;
        specialArgs = {inherit system;};
    };
    mkHomeManager = confName: user: system:  # unfortunately, home-manager configs are still system-specific
    # FIXME: this is thus still linux-x86_64 specific
    home-manager.lib.homeManagerConfiguration {
      pkgs = nixpkgs.legacyPackages.${system};
      modules = [
        {
          imports = [
            nur.hmModules.nur
            # TODO: $name can be utilised to conditionally load other config files
            ./home/home.nix
          ];
          # extends the home config
          home.username = user;
          home.homeDirectory = "/home/${user}";
        }
      ];
      # Optionally use extraSpecialArgs
      # to pass through arguments to home.nix
      extraSpecialArgs = {
        inherit inputs system;
      };
    };
  in
  {
    overlays.default = import ./packages;
    nixosConfigurations = {
      thinknix = mkSystem systems.x86_64-linux [ ./hosts/thinknix inputs.nixos-hardware.nixosModules.lenovo-thinkpad-t440s lanzaboote.nixosModules.lanzaboote ];
      framenix = mkSystem systems.x86_64-linux [ ./hosts/framenix inputs.nixos-hardware.nixosModules.framework-13-7040-amd lanzaboote.nixosModules.lanzaboote ];
    };
    homeConfigurations.spiollinux = mkHomeManager "spiollinux" "spiollinux" systems.x86_64-linux;
  } // utils.lib.eachDefaultSystem(system:
    let
      nixpkgs = import inputs.nixpkgs {
        inherit system;
        overlays = nixpkgs.lib.attrValues self.overlays;
      };
      pkgs = inputs.nixpkgs.legacyPackages.${system};
    in {
      devShells.default = pkgs.mkShell {
        buildInputs = [];
      };
      # expose nixpkgs with overlay; TODO: figure out role of config
      #legacyPackages = nixpkgs;
    });
}